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REMARKS 

The Examiner has rejected Claims 1-3, 5-12, 14-21, 23-30, 32-39, 41-48 and 50- 
54 under 35 U.S.C. 1 03(a) as being unpatentable over Lahti et al, (U.S. Patent 
Application No. 2002/0042886) in view of Hansson (WO 98/38820). Applicant 
respectfully disagrees with such rejection. 

With respect to each of the independent claims, the Examiner has relied on 
paragraphs [0019] and [0023] in Lahti along with page 6, lines 1-5 in Hansson to make a 
prior art showing of applicant's claimed technique "wherein said mobile data processing 
device registers with a base station of said wireless telephony network when said link is 
established such that said base station and said wireless telephony network are notified of 
a telephone number of said mobile data processing device for use in sending said 
malware definition updating data to said mobile data processing device," 

First, applicant respectfully asserts that neither Lahti nor Hansson disclose a 
"mobile data processing device [that] registers with a base station of said wireless 
telephony network when said link is established," as claimed by applicant (emphasis 
added). In particular, Lahti only generally teaches that "a record of all subscribers to the 
anti-virus server [is maintained] in a database" (paragraph [0023]), but not that a "mobile 
data processing device registers with a base station, . . when said link is established," as 
applicant claims. In addition, the entire Hansson reference, and in particular the excerpt 
in Hansson relied on by the Examiner, fails to even suggest any sort of registration, and 
especially not in the specific manner claimed by applicant. 

Second, applicant notes that the Examiner has relied on Hansson' s disclosure of 
an update server processor 100 [that] downloads the software by placing a call to the 
cellular phone and performing. . , [a] data transfer to the cellular telephone 1 10." 
Applicant respectfully asserts that simply utilizing a phone number to transfer a 
download does not meet applicant's specific claim language, namely that a "mobile data 
processing device registers with a base station of said wireless telephony network when 
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said link is established such that said base station and said wireless telephony network are 
notified of a telephone number of said mobile data processing device for use in sending 
said malware definition updating data to said mobile data processing device" (emphasis 
added), in the context claimed. 

In feet, applicant emphasizes that Hansson actually teaches away from registering 
such that notification of a telephone number is made, in the manner claimed by applicant, 
since Hansson discloses that "|T|n response to the cellular telephone subscriber^ 
acceptance of the update, the cellular telephone 110 transmits a SMS message to the 
update server processor 100, wherein the message contains an acceptance code and the 
telephone number of the cellular telephone 1 10" (see page 5, lines 1 5-18-emphasis 
added). 

Still with respect to each of the independent claims, the Examiner has relied on 
paragraphs [0022]-[0027] in Lahti to make a prior art showing of applicant's claimed 
technique "wherein said malware definition updating data is provided in a malware 
definition updating file, where said file is generated by one of automatically, semi- 
automatically, and manually upon an analysis of newly discovered malware and where 
said file includes a detection fingerprint, and at least one of a removal action and a 
disinfection action to be taken in response to a detection of said newly discovered 
malware," 

Applicant respectfully asserts that such excerpt from Lahti only discloses an 
"SMS request. . .containing signatures for viruses discovered and analysed since the 
previous update. . .which causes the new signature(s) to be incorporated into the anti-virus 
database for future use." Thus, Lahti teaches that the message only contains the updated 
virus signatures, and not that the "file includes.. . at least one of a removal action and a 
disinfection action to be taken in response to a detection of said newly discovered 
malware," as claimed by applicant To further emphasize such distinction, applicant 
points out paragraph [0027] in Lahti which states that "the user is warned 30 and given 
the opportunity to delete or clean that file." Clearly, a user that must decide whether to 
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delete or clean a file does not suggest that a malware definition updating file "includes at 
least one of a removal action and a disinfection action to be taken in response to a 
detection of said newly discovered malware" (emphasis added), as applicant claims. 

Furthermore, with respect to each of the independent claims, the Examiner has 
failed to specifically address applicant's claimed technique "wherein said mobile data 
processing device is identified by a database of subscribers to an update service 
associated with said malware scanner, where said database includes said telephone 
number of said mobile data processing device to which said malware definition updating 
data is to be sent and a type of said mobile data processing device such that only malware 
definition updating data that is appropriate to said type of said mobile data processing 
device is sent to said mobile data processing device" (emphasis added). 

Applicant notes, however, that in Lahti "an SMS message [is sent] to the server 
12 from a device 1 ...containing details of which virus signatures are currently stored in 
the device's signature database" such that "the anti-virus server 12 needs only to issue an 
SMS request.. .containing virus signatures not currently on the signature database of the 
mobile device 1." Thus, Lahti only teaches determining appropriate updated signatures 
based on si gnatures already located on the device, and not that a "database includes a 
type of said mobile data processing device such that only malware definition updating 
data that is appropriate to said type of said mobile data processing device is sent to said 
mobile data processing device," as applicant claims (emphasis added). 

To establish zprima facie case of obviousness, three basic criteria must be met 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
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prior art and not based on applicant's disclosure. In re Vaeck,947 F.2d 488, 20 USPQ2d 
1438(Fed.Cir.l991), 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Thus, all of the 
independent claims are deemed allowable. Moreover, the remaining dependent claims 
are further deemed allowable, in view of their dependence on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100, The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P449/0L143.01). 



P.O. Box 721120 

San Jose, CA 95172-1120 

408-505-5100 



Kevin 
Regis* 



Respei 
afloat 




fan No. 41,429 



emitted, 



PAGE 8/8'RCVDAT 3/23/2006 4:25:56 PM [Eastern Standard Time] ' SVR:USPTO€FXRF-6/30 ' DNISOTOO 4 CSID:40897U660 1 DURATION (mm-ss):01-56 



